v0.4.3

Security

• Apply, import, reconcile, and rollback now collect and compare two complete
  post-authorization schema states, rebuild the plan from the stable state, and
  bind the exact target, current schema, desired schema, risk, statements, and
  snapshot before DDL execution. Detectable post-authorization drift fails
  closed; genuine no-op paths remain R0 and create no mutation intent.
• Real MySQL SHOW CREATE TABLE output is preserved as validated opaque DDL
  when it can be recreated exactly. PostgreSQL introspection emits supported
  structured schemas; unsupported, ambiguous, cross-object, or lossy DDL forms
  fail closed instead of producing an incomplete rollback.

Changed

• Updated the shared opskit-core/v2 dependency to v2.0.3, carrying corrected
  committed-state reporting for secure-file replacements that encounter a
  later durability error.

Fixed

• Canonicalized MySQL table DDL consistently across introspection, comparison,
  export, and recreation, and corrected PostgreSQL foreign-key introspection
  for current server versions by joining separately unnested key arrays by
  ordinal position.
• The npm launcher now reports asynchronous spawn failures, propagates process
  signals, and maps missing exit codes to failure. Install scripts remain
  compatible with Node.js 14.
• Narrowed schema capability and workflow documentation to the behavior that
  the implementation and real-database tests can prove.

v0.4.2

Security

• Read-only SQL classification now permits only recognized unquoted MySQL
  native functions and canonically pg_catalog-qualified PostgreSQL functions;
  unknown, shadowable, quoted-ambiguous, extension, and user-defined function
  calls fail closed.
• Desired-schema parsing now rejects constraints and column modifiers that
  cannot be represented losslessly instead of silently dropping them.
• Schema mutations bind the authorized plan to the target, current and desired
  schemas, rendered statements, and risk decision, then revalidate that binding
  before snapshot creation or DDL execution.
• npm installation now trusts only the exact six platform digests embedded in
  the provenance-bound package manifest. Release automation verifies the signed
  checksum and binary bundle before GitHub Release and npm publication, while
  verified downloads use exclusive temporary files, bounded transfers, fsync,
  and atomic replacement without a verification bypass.

Fixed

• PostgreSQL DDL commit errors are reported as indeterminate partial failures,
  and every statement in the transaction is recorded as uncertain rather than
  incorrectly implying rollback.
• Invalid output formats are rejected at command preflight.
• Updated Cosign to v2.6.4 and hardened CI checks for installer tests and the
  exact five-file npm package.

Changed

• Updated opskit-core/v2 to v2.0.2 for shared owner-only, no-follow,
  durable-atomic context and encrypted credential storage.
• Updated golang.org/x/crypto, x/net, x/sys, and x/term to their current
  patched releases.

v0.4.1

Security

• Upgraded golang.org/x/text to v0.39.0 to remediate reachable
  GO-2026-5970. Because v0.4.0 was already published, the remediation ships in
  v0.4.1.
• Release automation now requires a GitHub-verified signed annotated tag whose
  version matches package.json, an exact literal changelog heading, and the
  freshly fetched origin/main commit; complete CI/vulnerability and real-DB
  gates rerun on that tag commit before publication can start.
• MySQL and PostgreSQL integration images are pinned to the digests exercised
  by the successful v0.4.0 release run, and CI now fails rather than silently
  skipping the real-database suite when a required endpoint is missing.

Fixed

• Release checksum aggregation now merges matrix artifacts without Unix
  binary/directory name collisions, verifies all six per-platform checksum
  files, and fails unless the global manifest contains exactly six binaries.

v0.4.0

Warning

Superseded by v0.4.1. This release has a reachable GO-2026-5970 dependency path; upgrade to v0.4.1.

Added

• Added two-phase mutation auditing with intent-before-effect, correlated outcomes, and commit-aware durable replay for definitely uncommitted audit outcomes.

Changed

• BREAKING: Context replacement, selection, import, credential migration, role changes, and confirmed audit pruning are fixed R3 governance operations with precise --allow-* authorization.
• Updated to opskit-core/v2 v2.0.0. Confirmed audit pruning is now authenticated, checkpoint-aware, bound to the exact rotation set, and recorded in a sibling control log.

Fixed

• Hardened read-only SQL classification against writable CTEs, locking clauses, side-effecting functions, and MySQL variable assignment; accepted queries and EXPLAIN operations now run in explicitly rolled-back read-only transactions.
• Governed DML revalidates its EXPLAIN binding before execution, snapshots are bound to their context and physical database target, and applicable PostgreSQL DDL batches execute transactionally with fixed-schema qualification.
• Hardened the npm installer against redirect-time file truncation, stalled requests, unsafe checksum redirects, and unhandled 307/308 or relative redirects.

Security

• Authorization identity now derives from the local OS user and hostname. Persisted audit and telemetry use fingerprints and bounded counters instead of raw tickets, reasons, SQL, database targets, output, or backend error text.

v0.3.2

Changed

• Updated opskit-core to v1.1.4.

v0.3.1

Changed

• Internal: release version injection now uses main.version, main.commit, and main.built for family workflow consistency.

v0.2.14

Changed

• Installer environment variables now prefer the family-standard DBGOV_DOWNLOAD_MIRROR and DBGOV_SKIP_VERIFY names; deprecated DBGOV_CLI_DOWNLOAD_MIRROR and DBGOV_CLI_SKIP_VERIFY remain supported.

v0.2.13

Changed

• capabilities -o json now reports contextApiVersions and auditApiVersions arrays for family schema alignment.

v0.2.12

Added

• Global flags: --debug, --trace, --no-color.

v0.2.11

Changed

• Simplified capabilities -o plain output to a script-friendly command list.